Recent PPNNs [1]}, [2]}, [3]}, [4]}, [5]}, [6]} adopt HE to implement their linear layers. Unfortunately, HE cannot support non-linear activation layers. Interactive PPNNs [1]}, [2]} take advantage of multi-party computation to compute activation by interactions between the client and the server. In contrast, non-interactive PPNNs [3]}, [4]}, [5]}, [6]} approximate activations by a degree-2 polynomial, e.g., square function, so that the entire PPNN inference happens on only the server. Non-interactive PPNNs are more friendly to the clients who have no powerful machines and high-bandwidth network connections. The latest interactive PPNN, Delphi [2]}, has to exchange 2GB data between the server and the client for only a ResNet-32 inference on an encrypted CIFAR-10 image. In this paper, we focus on only non-interactive PPNNs.
